From 394b9dd04b4e3f082326c2cec068b02ebbfdbd56 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Mon, 3 Aug 2026 10:50:08 +0200
Subject: [PATCH 1/3] DevicePostureCheckRequest takes device's polling token to
 authenticate it

---
 enterprise/v2/posture/posture.proto | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/enterprise/v2/posture/posture.proto b/enterprise/v2/posture/posture.proto
index fa4022c..32ceb06 100644
--- a/enterprise/v2/posture/posture.proto
+++ b/enterprise/v2/posture/posture.proto
@@ -60,6 +60,8 @@ message DevicePostureCheckRequest {
   int64 location_id = 1;
   string pubkey = 2;
   DevicePostureData device_posture_data = 3;
+  // Polling token of the calling device, used to authenticate the request.
+  optional string token = 4;
 }
 
 message DevicePostureCheckResponse {

From b3fa078221293983d7d8af9d1de834308653b95b Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Tue, 4 Aug 2026 07:38:39 +0200
Subject: [PATCH 2/3] client AuthorizePostureSession grpc and ServiceLocation
 mods

---
 v1/client/client.proto | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/v1/client/client.proto b/v1/client/client.proto
index 4a89c29..5fad41e 100644
--- a/v1/client/client.proto
+++ b/v1/client/client.proto
@@ -58,12 +58,18 @@ message ServiceLocation {
   uint32 keepalive_interval = 6;
   string dns = 7;
   ServiceLocationMode mode = 8;
+  int64 network_id = 9;
+  bool posture_check_required = 10;
 }
 
 message SaveServiceLocationsRequest {
   repeated ServiceLocation service_locations = 1;
   string instance_id = 2;
   string private_key = 3;
+  string proxy_url = 4;
+  string device_pubkey = 5;
+  // Device polling token
+  optional string token = 6;
 }
 
 message DeleteServiceLocationsRequest {
@@ -84,6 +90,18 @@ message ListInterfacesResponse {
   repeated ManagedInterfaceData interfaces = 1;
 }
 
+message AuthorizePostureSessionRequest {
+  string proxy_url = 1;
+  string device_pubkey = 2;
+  int64 location_id = 3;
+  // Device polling token
+  optional string token = 4;
+}
+
+message AuthorizePostureSessionResponse {
+  string preshared_key = 1;
+}
+
 // service used by desktop clients to communicate with interface management
 // daemon
 service DesktopDaemonService {
@@ -94,4 +112,5 @@ service DesktopDaemonService {
   rpc DeleteServiceLocations(DeleteServiceLocationsRequest) returns (google.protobuf.Empty);
   rpc GetPostureData(google.protobuf.Empty) returns (defguard.enterprise.posture.v2.DevicePostureData);
   rpc ListInterfaces(google.protobuf.Empty) returns (ListInterfacesResponse);
+  rpc AuthorizePostureSession(AuthorizePostureSessionRequest) returns (AuthorizePostureSessionResponse);
 }

From 6867db7bc454023df5fb0d7d15d3482aed5e936d Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Wed, 5 Aug 2026 12:08:06 +0200
Subject: [PATCH 3/3] remove posture check rpc

---
 v1/client/client.proto | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/v1/client/client.proto b/v1/client/client.proto
index 5fad41e..7b0efa2 100644
--- a/v1/client/client.proto
+++ b/v1/client/client.proto
@@ -90,18 +90,6 @@ message ListInterfacesResponse {
   repeated ManagedInterfaceData interfaces = 1;
 }
 
-message AuthorizePostureSessionRequest {
-  string proxy_url = 1;
-  string device_pubkey = 2;
-  int64 location_id = 3;
-  // Device polling token
-  optional string token = 4;
-}
-
-message AuthorizePostureSessionResponse {
-  string preshared_key = 1;
-}
-
 // service used by desktop clients to communicate with interface management
 // daemon
 service DesktopDaemonService {
@@ -112,5 +100,4 @@ service DesktopDaemonService {
   rpc DeleteServiceLocations(DeleteServiceLocationsRequest) returns (google.protobuf.Empty);
   rpc GetPostureData(google.protobuf.Empty) returns (defguard.enterprise.posture.v2.DevicePostureData);
   rpc ListInterfaces(google.protobuf.Empty) returns (ListInterfacesResponse);
-  rpc AuthorizePostureSession(AuthorizePostureSessionRequest) returns (AuthorizePostureSessionResponse);
 }